OBIE – Open Ban Intelligence Exchange
A decentralised, federated security mesh: autonomous nodes exchange cryptographically signed attacker signals without surrendering control of their own firewall to a central authority. Reputation-weighted consensus, evidence over authority, no leaders.
“NEIGHBOURHOOD WATCH, NOT POLICE STATE”
The problem: the centralisation trap
Distributed attacks are defended today with centralised intelligence. That is efficient and has four failure modes, all of which happen regularly:
- A single point of failure
An outage or compromise at the central provider leaves every connected system unprotected at once.
- Commercial choke points
Good threat data sits behind paywalls – a security divide between large enterprises and small operators.
- Opaque decisions
Whoever centrally decides what counts as a threat can quietly turn a security feed into something else.
- Latency
What is decided in the provider's data centre often reaches the edge too late against automated attacks.
Threat model first
A leaderless mesh has an obvious attacker: the node that feeds in false signals. OBIE meets it with mechanism, not trust:
- Evidence over authority
Every signal is Ed25519-signed and carries hashes of the evidence – log excerpts, honeypot hits, event counts. Trust comes from verifiable data, not badges.
- Locally computed, weighted consensus
No node follows a signal blindly. Each computes a confidence from its peers' accuracy, stability, transparency and penalty history – a single compromised node poisons no firewall.
- Correctable mistakes
Reputation is observable, appeals run over direct RPC channels, false positives cost reputation. A mistake must be reversible, or the system is a weapon.
- Failure is the normal case
Nodes disappear, keys rotate. The mesh must degrade, not fail.
What OBIE does not do
The limits are in the manifesto, not in a footnote:
- No retaliation, no hunting
OBIE does not punish and does not strike back. It increases friction for attackers – that is the entire mission.
- No identities, no raw logs
What is shared are indicators – IP addresses, ASNs, TLS and SSH fingerprints, file hashes – never user data.
- No central switch, no tokens
There is no oracle, no kill switch and no economic token. The incentive is mutual defence.
- No node software – not yet
OBIE is a whitepaper with schema, threat model and consensus design. There is no running mesh, and therefore no numbers.
The ask: read the spec and try to break it.
Not join, not subscribe, not star. Where does reputation-weighted consensus fail? Which poisoning strategy does the threat model miss? An hour of critique from someone who means it is worth more than a hundred subscribers.